On Friday, July 17, 2026, Colombian state-controlled energy company Ecopetrol announced that a cyberattack led to the theft of data linked to approximately 3,300 user accounts. The company stated it could not "guarantee" that the breach would not have a "material adverse" financial impact.

Ecopetrol, which is Colombia's largest company and one of Latin America's biggest energy producers—accounting for over 60% of the country's hydrocarbon production—reported no critical disruption to its operations or production capacity as of the announcement. Additionally, no direct financial impact had been identified, and the stolen data had not yet been disclosed by the hacker.

The breach affected cloud-based file storage environments of 15 subsidiaries, including Ecopetrol itself. The company successfully prevented an attempted ransomware attack linked to the incident.

While the hacker remains unidentified, Ecopetrol said the attacker communicated extortion demands and threatened to publicly release the stolen information. The company is continuing to assess the potential exposure, which may involve confidential, proprietary, or personal data. It warned that the incident could materially affect its business, reputation, operating results, or financial condition.

Sources

CNA Latest News